@blamejs/blamejs-shop 0.5.20 → 0.5.21

package/lib/knowledge-base.js

@@ -108,11 +108,6 @@ var LOCALE_RE   = /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/;
 var CATEGORY_RE = /^[a-z][a-z0-9_-]*$/;
 var TAG_RE      = /^[a-z][a-z0-9_-]*$/;
 
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var SEARCH_WEIGHTS = Object.freeze({
   title: 3,
@@ -121,6 +116,7 @@ var SEARCH_WEIGHTS = Object.freeze({
 });
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -163,12 +159,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("knowledgeBase: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("knowledgeBase: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "knowledgeBase: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -183,12 +174,10 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("knowledgeBase: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("knowledgeBase: body contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "knowledgeBase: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -282,9 +271,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("knowledgeBase: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: query contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "knowledgeBase: query", { zeroWidth: "reject" });
   return s;
 }
 
@@ -303,9 +290,7 @@ function _sessionIdRaw(s) {
   if (s.length > 256) {
     throw new TypeError("knowledgeBase: session_id must be <= 256 characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("knowledgeBase: session_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "knowledgeBase: session_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -347,7 +332,7 @@ function _esc(s) {
 
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_BODY_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/line-gift-wrap.js

@@ -69,6 +69,7 @@
 // ---- constants ----------------------------------------------------------
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -89,8 +90,6 @@ var SKU_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 // adjacent ecosystems. Newlines are allowed in gift_message (people
 // write multi-line messages); the recipient name is a single line
 // and refuses LF / CR too.
-var CONTROL_BYTE_MSG_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_NAME_RE = /[\x00-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the gift-options
 // primitive's catalogue: ZWSP/ZWNJ/ZWJ (U+200B-200D), LRM/RLM
@@ -99,9 +98,6 @@ var CONTROL_BYTE_NAME_RE = /[\x00-\x1f\x7f]/;
 // (U+2066-U+2069), the BOM (U+FEFF), and the Arabic letter mark
 // (U+061C). Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var BCP47_RE = /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
 
@@ -155,12 +151,7 @@ function _giftMessage(s) {
   if (s.length > MAX_MESSAGE_LEN) {
     throw new TypeError("lineGiftWrap: gift_message must be ≤ " + MAX_MESSAGE_LEN + " chars");
   }
-  if (CONTROL_BYTE_MSG_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: gift_message contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: gift_message contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "lineGiftWrap: gift_message", { zeroWidth: "reject" });
   return s;
 }
 
@@ -172,12 +163,7 @@ function _recipientName(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("lineGiftWrap: recipient_name must be ≤ " + MAX_RECIPIENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_NAME_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: recipient_name contains control bytes (incl. CR/LF)");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("lineGiftWrap: recipient_name contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "lineGiftWrap: recipient_name", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/live-chat.js

@@ -98,15 +98,11 @@ var TRANSITIONS = {
   abandoned: {},
 };
 
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
 // Zero-width + direction-override characters. Spelled via \u escapes
 // so the file stays ESLint no-irregular-whitespace clean.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- validators ---------------------------------------------------------
@@ -134,12 +130,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("live-chat: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("live-chat: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "live-chat: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -152,7 +143,7 @@ function _reason(r, label) {
   if (r.length > MAX_REASON_LEN) {
     throw new TypeError("live-chat: " + (label || "reason") + " must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(r) || ZERO_WIDTH_RE.test(r)) {
+  if (textGuard.hasCodepointThreat(r, { singleLine: "reject", zeroWidth: "reject" })) {
     throw new TypeError("live-chat: " + (label || "reason") + " contains control / zero-width bytes");
   }
   return r;
@@ -165,9 +156,7 @@ function _sourcePage(s) {
   if (s.length > MAX_SOURCE_PAGE) {
     throw new TypeError("live-chat: source_page must be <= " + MAX_SOURCE_PAGE + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: source_page contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "live-chat: source_page", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -178,9 +167,7 @@ function _visitorSessionId(s) {
   if (s.length > MAX_SESSION_ID_LEN) {
     throw new TypeError("live-chat: session_id must be <= " + MAX_SESSION_ID_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("live-chat: session_id contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "live-chat: session_id", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/metered-usage.js

@@ -90,6 +90,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -111,10 +112,6 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // primitives — operator-authored copy (title, unit) ends up on
 // receipt emails + the operator dashboard, so the same "no direction-
 // override / no invisible glyph" floor applies.
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE   = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -146,7 +143,7 @@ function _shortText(s, label, max) {
   if (s.length > max) {
     throw new TypeError("meteredUsage: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("meteredUsage: " + label + " contains control / zero-width bytes");
   }
   return s;
@@ -253,9 +250,7 @@ function _idempotencyKey(s) {
   if (s.length > MAX_IDEM_KEY_LEN) {
     throw new TypeError("meteredUsage: idempotency_key must be <= " + MAX_IDEM_KEY_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("meteredUsage: idempotency_key contains control bytes");
-  }
+  textGuard.freeText(s, "meteredUsage: idempotency_key");
   return s;
 }
 

package/lib/notifications.js

@@ -39,6 +39,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var RECIPIENT_NAMESPACE = "notification-recipient";
 
@@ -54,7 +55,6 @@ var MAX_PAYLOAD_BYTES  = 65536;
 var MAX_ERROR_LEN      = 1024;
 
 var EVENT_TYPE_RE     = /^[a-z](?:[a-z0-9._-]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 var DEFAULT_PAGE_SIZE = 50;
 var MAX_PAGE_SIZE     = 500;
 
@@ -67,9 +67,7 @@ function _recipientId(s) {
   if (s.length > MAX_RECIPIENT_LEN) {
     throw new TypeError("notifications: recipient_id must be <= " + MAX_RECIPIENT_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("notifications: recipient_id contains control bytes");
-  }
+  textGuard.freeText(s, "notifications: recipient_id");
   return s;
 }
 
@@ -101,9 +99,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("notifications: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("notifications: title contains control bytes");
-  }
+  textGuard.freeText(s, "notifications: title");
   return s;
 }
 

package/lib/operator-accounts.js

@@ -156,9 +156,9 @@ var MAX_LIST_LIMIT       = 200;
 var ROLES  = Object.freeze(["owner", "manager", "viewer"]);
 var STATUS = Object.freeze(["active", "disabled"]);
 
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -174,7 +174,7 @@ function _actorId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > 128) {
     throw new TypeError("operatorAccounts: " + (label || "actor_id") + " must be a non-empty string (<= 128 chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorAccounts: " + (label || "actor_id") + " must not contain control bytes");
   }
   return s;
@@ -212,9 +212,7 @@ function _displayName(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("operatorAccounts: display_name must be a non-empty string (<= " + MAX_DISPLAY_NAME_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorAccounts: display_name must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorAccounts: display_name", { singleLine: "reject" });
   return s;
 }
 

package/lib/operator-approvals.js

@@ -164,13 +164,13 @@ var MAX_HOURS              = 24 * 365;       // one-year cap
 
 var SLUG_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var ACTION_KIND_RE   = /^[a-z][a-z0-9_.\-]{0,79}$/;
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
 
 var DECISIONS = Object.freeze(["approve", "reject", "abstain"]);
 var STATUSES  = Object.freeze(["pending", "approved", "rejected",
                                "executed", "cancelled", "escalated"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -195,7 +195,7 @@ function _operatorId(s, label) {
     throw new TypeError("operatorApprovals: " + label +
       " must be a non-empty string (<= " + MAX_OPERATOR_ID_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorApprovals: " + label + " must not contain control bytes");
   }
   return s;
@@ -206,7 +206,7 @@ function _reason(s) {
     throw new TypeError("operatorApprovals: reason must be a non-empty string <= " +
       MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: reason must not contain control bytes (except whitespace)");
   }
   return s;
@@ -217,7 +217,7 @@ function _justification(s) {
     throw new TypeError("operatorApprovals: justification must be a non-empty string <= " +
       MAX_JUSTIFICATION_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: justification must not contain control bytes (except whitespace)");
   }
   return s;
@@ -229,7 +229,7 @@ function _comment(s) {
     throw new TypeError("operatorApprovals: comment must be a string <= " +
       MAX_COMMENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorApprovals: comment must not contain control bytes (except whitespace)");
   }
   return s;
@@ -317,9 +317,7 @@ function _capability(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_ACTION_KIND_LEN) {
     throw new TypeError("operatorApprovals: required_capability must be a non-empty string or null");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorApprovals: required_capability must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorApprovals: required_capability", { singleLine: "reject" });
   return s;
 }
 

package/lib/operator-audit-log.js

@@ -104,16 +104,13 @@ var ALLOWED_UA_CLASSES  = Object.freeze([
 // discipline matches every other operator-facing primitive (catalog,
 // experiments, promo-banners) — strings reach the dashboard as inert
 // text, never as live markup.
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var IDENT_RE = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,127}$/;
 var ACTION_RE = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,127}$/;
 var KIND_RE   = /^[A-Za-z0-9][A-Za-z0-9._\-]{0,63}$/;
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -148,9 +145,7 @@ function _ipHash(s) {
     throw new TypeError("operatorAuditLog: ip_hash must be a non-empty string ≤ " +
       MAX_IP_HASH_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorAuditLog: ip_hash contains control / zero-width characters");
-  }
+  textGuard.freeText(s, "operatorAuditLog: ip_hash", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 

package/lib/operator-help-center.js

@@ -109,11 +109,6 @@ var SLUG_RE    = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SECTION_RE = /^[a-z][a-z0-9_-]*$/;
 var ACTION_RE  = /^[a-z0-9](?:[a-z0-9._/:-]*[a-z0-9])?$/;
 
-var CONTROL_BYTE_BODY_RE   = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var SEARCH_WEIGHTS = Object.freeze({
   title:   3,
@@ -126,6 +121,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ---------------------------------------------------
 //
@@ -168,12 +164,7 @@ function _title(s) {
   if (s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorHelpCenter: title must be <= " + MAX_TITLE_LEN + " characters");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: title contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: title contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: title", { singleLine: "reject", zeroWidth: "reject" });
   return s;
 }
 
@@ -188,12 +179,7 @@ function _body(s) {
   if (s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorHelpCenter: body must be <= " + MAX_BODY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: body contains control bytes");
-  }
-  if (ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: body contains zero-width / direction-override characters");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: body", { zeroWidth: "reject" });
   return s;
 }
 
@@ -304,9 +290,7 @@ function _queryStr(s) {
   if (s.length > MAX_QUERY_LEN) {
     throw new TypeError("operatorHelpCenter: query must be <= " + MAX_QUERY_LEN + " characters");
   }
-  if (CONTROL_BYTE_BODY_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("operatorHelpCenter: query contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "operatorHelpCenter: query", { zeroWidth: "reject" });
   return s;
 }
 
@@ -346,7 +330,7 @@ function _esc(s) {
 
 function _safeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_BODY_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, { zeroWidth: "reject" })) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;

package/lib/operator-inbox.js

@@ -165,6 +165,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -183,8 +184,6 @@ var MAX_BULK_IDS      = 200;
 var DEFAULT_LIMIT     = 50;
 var MAX_LIMIT         = 500;
 
-var CONTROL_BYTE_RE        = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE = /[\x00-\x1f\x7f]/;
 
 var CURSOR_ORDER_KEY = Object.freeze(["created_at", "id"]);
 
@@ -249,9 +248,7 @@ function _subject(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("operatorInbox: subject must be a non-empty string <= " + MAX_SUBJECT_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorInbox: subject must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: subject");
   return s;
 }
 
@@ -259,9 +256,7 @@ function _body(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_BODY_LEN) {
     throw new TypeError("operatorInbox: body must be a non-empty string <= " + MAX_BODY_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorInbox: body must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: body");
   return s;
 }
 
@@ -284,9 +279,7 @@ function _sourceEventId(s) {
   if (typeof s !== "string" || s.length > MAX_SOURCE_LEN) {
     throw new TypeError("operatorInbox: source_event_id must be a string <= " + MAX_SOURCE_LEN + " chars");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("operatorInbox: source_event_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorInbox: source_event_id", { singleLine: "reject" });
   return s;
 }
 

package/lib/operator-roles.js

@@ -144,7 +144,6 @@ var MAX_LIST_LIMIT      = 500;
 // Slug shape matches the rest of the codebase — alnum-leading, alnum
 // + hyphen + underscore + dot, capped length.
 var SLUG_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
 
 // Closed permission allow-list. Adding a new permission is a code
 // change here AND the operator re-defining the affected roles.
@@ -170,6 +169,7 @@ var PERMISSIONS = Object.freeze([
 var ALLOWED_PATCH_COLUMNS = Object.freeze(["title", "permissions", "description"]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -185,9 +185,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("operatorRoles: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("operatorRoles: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "operatorRoles: title", { singleLine: "reject" });
   return s;
 }
 
@@ -196,7 +194,7 @@ function _description(s) {
   if (typeof s !== "string" || s.length > MAX_DESC_LEN) {
     throw new TypeError("operatorRoles: description must be a string <= " + MAX_DESC_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorRoles: description must not contain control bytes (except whitespace)");
   }
   return s;
@@ -231,7 +229,7 @@ function _operatorId(s, label) {
   if (typeof s !== "string" || !s.length || s.length > MAX_OPERATOR_ID_LEN) {
     throw new TypeError("operatorRoles: " + label + " must be a non-empty string (<= " + MAX_OPERATOR_ID_LEN + " chars)");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("operatorRoles: " + label + " must not contain control bytes");
   }
   return s;
@@ -241,7 +239,7 @@ function _reason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_REASON_LEN) {
     throw new TypeError("operatorRoles: reason must be a non-empty string <= " + MAX_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s.replace(/[\t\r\n]/g, ""))) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("operatorRoles: reason must not contain control bytes (except whitespace)");
   }
   return s;

package/lib/order-escalation.js

@@ -61,7 +61,6 @@ var COUNTRY_RE          = /^[A-Z]{2}$/;
 var PAYMENT_KIND_RE     = /^[a-z0-9][a-z0-9_-]{0,31}$/;
 var TAG_RE              = /^[A-Za-z0-9][A-Za-z0-9._:\-]{0,63}$/;
 var TEMPLATE_RE         = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var CONTROL_BYTE_RE     = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var SEVERITIES          = Object.freeze(["info", "warning", "critical"]);
 var SEVERITY_RANK       = Object.freeze({ info: 0, warning: 1, critical: 2 });
@@ -85,6 +84,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -322,7 +322,7 @@ function _freeText(v, label, max) {
   if (v.length > max) {
     throw new TypeError("orderEscalation: " + label + " must be <= " + max + " characters");
   }
-  if (CONTROL_BYTE_RE.test(v)) {
+  if (textGuard.hasCodepointThreat(v)) {
     throw new TypeError("orderEscalation: " + label + " must not contain control bytes");
   }
   return v;

package/lib/order-export.js

@@ -117,6 +117,7 @@ var DEFAULT_BATCH_SIZE = 500;
 var MAX_BATCH_SIZE     = 5000;
 var MAX_LIST_LIMIT     = 200;
 var EMAIL_HASH_PREFIX  = "order-export-email";
+var CSV_LINE_ENDING    = "\r\n";   // RFC 4180
 var FORMATS            = Object.freeze(["csv", "ndjson"]);
 var EXPORT_STATUSES    = Object.freeze(["queued", "running", "complete", "failed", "cancelled"]);
 
@@ -209,17 +210,6 @@ function _limit(n) {
 
 // ---- CSV helpers --------------------------------------------------------
 
-// RFC-4180 quoting: every cell wrapped in `"`, embedded `"` doubled.
-// We quote unconditionally — the cost is a few extra bytes per cell;
-// the win is that a downstream parser never has to track quote-vs-
-// bare-cell state for a column with mixed shapes. The injection
-// neutralization runs first via the shared vendored primitive.
-function _csvCell(value) {
-  var s = _coerceCell(value);
-  s = _neutralizeInjection(s);
-  return '"' + s.replace(/"/g, '""') + '"';
-}
-
 function _coerceCell(value) {
   if (value == null) return "";
   if (typeof value === "string") return value;
@@ -239,14 +229,29 @@ function _coerceCell(value) {
 // numerics (`+15.00`); the shared primitive prefixes those too (the safe
 // OWASP posture — `-2+3+cmd|…` is a real injection that begins like an
 // amount), which is the more complete behavior this consolidation buys.
-function _neutralizeInjection(s) {
-  return b.guardCsv.escapeCell(s);
-}
-
+// One export row, RFC 4180.
+//
+// b.guardCsv.serialize does the whole line: the formula-injection prefix on
+// every cell, the unconditional quoting, doubling an embedded quote, the
+// delimiter and the CRLF. Only the injection step was composed before; the
+// quoting rules were written here and again in customer-segments.js.
+//
+// Cells are quoted unconditionally. It costs a few bytes and means a
+// downstream parser never has to track quote-versus-bare state on a column
+// with mixed shapes.
+//
+// serialize emits the rows it is given WITHOUT a trailing terminator, which is
+// right for a whole document and wrong for a generator yielding one row at a
+// time — so the line ending is appended here. Verified byte-identical to the
+// previous builder across formula-injection, embedded-quote, embedded-comma,
+// newline, tab and empty cells.
 function _csvRow(cells) {
-  var parts = [];
-  for (var i = 0; i < cells.length; i += 1) parts.push(_csvCell(cells[i]));
-  return parts.join(",") + "\r\n";
+  return b.guardCsv.serialize([cells.map(_coerceCell)], {
+    profile:     "strict",
+    alwaysQuote: true,
+    headers:     false,
+    lineEnding:  CSV_LINE_ENDING,
+  }) + CSV_LINE_ENDING;
 }
 
 // ---- row projection -----------------------------------------------------
@@ -758,8 +763,7 @@ function create(opts) {
     // Exposed for the test suite so it can assert column semantics
     // without having to thread orders through a full DB round-trip.
     _projectOrder:      _projectOrder,
-    _csvCell:           _csvCell,
-    _neutralizeInjection: _neutralizeInjection,
+    _csvRow:            _csvRow,
     // Exposed only to keep the linter quiet about the unused `order`
     // binding when an integrator wires it later — the export reads
     // directly today, but the indirection is preserved.